In Dynamic Random Access Memory (DRAM), each bit of stored data occupies a separate memory cell that is typically implemented with one capacitor and one transistor. The charge state of a capacitor (charged or discharged) is what determines whether a DRAM cell stores “1” or “0” as a binary value. Large numbers of DRAM memory cells are packed into integrated circuits, together with some additional logic that organizes the cells for the purposes of reading, writing and refreshing the data.
As shown in FIG. 1, memory cells 101 are further organized into matrices and addressed through rows and columns. A memory address 102 applied to a matrix is broken into the row address 103 and column address 104, which are processed by respective row and column address decoders 105 and 106. After a row address selects the row for a read operation (the selection is also known as row activation), bits from all cells in the row are transferred into the sense amplifiers 107 that form the row buffer, from which the exact bit is selected using the column address 104. Read operations are of a destructive nature because the design of DRAM requires memory cells to be rewritten after their values have been read. Write operations decode the addresses in a similar way, but as a result of the design entire rows must be rewritten for the value of a single bit to be changed.
As a result of storing data bits using capacitors that have a natural discharge rate, DRAM memory cells lose their state over time and require periodic rewriting of all memory cells, which is a process known as refreshing. As another result of the design, DRAM memory is susceptible to random changes in stored data, which are known as soft memory errors and attributed to a variety of causes.
Increased densities of DRAM integrated circuits (ICs) have led to physically smaller memory cells capable of storing smaller charges, resulting in lower operational noise margins, increased rates of electromagnetic interactions between memory cells, and greater possibility of data loss. As a result, disturbance errors have been observed, being caused by cells interfering with each other's operation and manifesting as random changes in the values of bits stored in affected memory cells. The awareness of disturbance errors dates back to the early 1970s and the Intel 1103 as the first commercially available DRAM IC; since then, DRAM manufacturers have employed various mitigation techniques to counteract disturbance errors, such as improving the isolation between cells and performing production testing. However, it has been proven that commercially available high density DRAM chips are susceptible to disturbance errors, caused by repeated accesses to neighboring memory cells. The term rowhammer is used to name the associated side effect that led to observed bit flips.
The opportunity for the rowhammer effect to occur in DRAM memories is primarily attributed to the large capacity DRAM's high density of memory cells and the results of associated interactions between the cells, while rapid DRAM row activations have been determined as the primary cause. Frequent row activations cause voltage fluctuations on the associated row selection lines, which have been observed to induce higher-than-natural discharge rates in capacitors belonging to nearby (adjacent, in most cases) memory rows, which are called victim rows; if the affected memory cells are not refreshed before they lose too much charge, disturbance errors occur. This is shown in FIG. 2, where frequent accesses to row 201 may induce unintended changes in victim row 202. Tests have also shown that the rate of disturbance errors is not substantially affected by increased environment temperature, but it depends on the actual contents of DRAM because certain bit patterns result in significantly higher disturbance error rates.
A variant called double-sided hammering shown in FIG. 3 involves targeted activations of two DRAM rows 301 and 302 surrounding the victim row 303. Tests show that this approach may result in a significantly higher rate of disturbance errors, compared to the variant that activates only one of the victim row's neighboring DRAM rows.